CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation

The pull loop already avoids out of bounds accesses beyond the end of
the buffer.  However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.

Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.

Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.  Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Reported-by: Martin Schwenke <mschwenke@ddn.com>
Reported-by: Also Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/ctdb/protocol/protocol_types.c b/ctdb/protocol/protocol_types.c
index 146e2ea41c7bbf37dcc05080a8408c0463a84128..a61b54fb4bdc6495b5f4807c4ad68d848589995e 100644 (file)
--- a/ctdb/protocol/protocol_types.c
+++ b/ctdb/protocol/protocol_types.c
@@ -925,6 +925,7 @@ int ctdb_vnn_map_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
        struct ctdb_vnn_map *val;
        size_t offset = 0, np;
        uint32_t i;
+       uint32_t dummy = 0;
        int ret;
 
        val = talloc(mem_ctx, struct ctdb_vnn_map);
@@ -950,6 +951,11 @@ int ctdb_vnn_map_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
                goto done;
        }
 
+       if ((uint64_t)val->size * ctdb_uint32_len(&dummy) > buflen - offset) {
+               ret = EMSGSIZE;
+               goto fail;
+       }
+
        val->map = talloc_array(val, uint32_t, val->size);
        if (val->map == NULL) {
                ret = ENOMEM;